RubyGems - wikk_web_auth - Versions diffs - 0.1.0 - Mend

wikk_web_auth 0.1.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (7) hide show

checksums.yaml ADDED Viewed

@@ -0,0 +1,7 @@
+---
+SHA1:
+  metadata.gz: ecd4829760efaf1668d18a19881a30066d68a6c0
+  data.tar.gz: a9c80865749876369330677d7fdad881ac8376eb
+SHA512:
+  metadata.gz: 6bcb14d568d41c9467dc5a844469f31115b28c09d9743ced5d9c856f61a0976e82f2b5dc07fc5cf4c36812f7a002450158068ca27b8ce7b88cec611b6fb3ec02
+  data.tar.gz: 726c057193a25b2cebc441853fd833ed2ef9be6c7075577c56110c9cd48cf46bc25437932487e60fcdb53da880c4989a042b2d3a5cdfef2441fd7bc6ca7870b7

data/History.txt ADDED Viewed

@@ -0,0 +1,6 @@
+=== 1.0.0 / 2016-06-19
+* 1 major enhancement
+  * Birthday!

data/Manifest.txt ADDED Viewed

@@ -0,0 +1,5 @@
+History.txt
+Manifest.txt
+README.md
+Rakefile
+lib/wikk_web_auth.rb

data/README.md ADDED Viewed

@@ -0,0 +1,85 @@
+# wikk_web_auth
+* http://wikarekare.github.com/wikk_web_auth/
+* Source https://github.com/wikarekare/wikk_web_auth
+* Gem https://rubygems.org/gems/wikk_web_auth
+## DESCRIPTION:
+Gem provides common authentication framework for Wikarekare's Ruby CGIs.
+## FEATURES/PROBLEMS:
+* In process of conversion from a library to a gem, and refactored to be more generic. Needs some real world testing.
+## SYNOPSIS:
+### Redirect to login scenario
+* Logic flows from clients to the cgi;
+* generating a login html page;
+* client logs in, sending the form to the login.rbx Ruby cgi;
+* If successful, the login.rbx cgi sends back a redirect to the original cgi.
+### Javascript Scenario, with separation of function.
+* A separate login button is included on the HTML page, which uses the wikk_auth_js library
+```
+  <html>
+  <head>
+    <script src="wikk_web_auth.js"></script>
+    ...
+    <script>
+      init() {
+        //Check if we are authenticated, and fill in login span appropriately.
+        logged_in(true, '/admin/sites.html'); //(display lock/unlock image, return url after login page)
+        ...
+      }
+      ...
+    </script>
+  </head>
+  <body onload="init();">
+    ...
+    <span id="login_span"></span>
+    ...
+```
+* The cgi simple calls the class level WIKK::Web_Auth.authenticate? call, for a true/false response.
+```
+  require 'wikk_web_auth'
+  @authenticated = Authenticated.authenticated?(@cgi)
+```
+## REQUIREMENTS:
+* Used in conjunction with Ruby cgi login.rbx
+* relies on gems wikk_password
+* Could make use of wikk_configuration and wikk_aes_256
+## INSTALL:
+* sudo gem install wikk_web_auth
+## LICENSE:
+(The MIT License)
+Derived from Wikarekare authentication.rb library.
+Copyright (c) 2004-2016
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

data/Rakefile ADDED Viewed

@@ -0,0 +1,27 @@
+# -*- ruby -*-
+require 'rubygems'
+require 'hoe'
+Hoe.plugin :yard
+Hoe.spec 'wikk_web_auth' do
+  self.readme_file = "README.md"
+  self.developer( "Rob Burrowes","r.burrowes@auckland.ac.nz")
+  remote_rdoc_dir = '' # Release to root
+  self.yard_title = 'wikk_web_auth'
+  self.yard_options = ['--markup', 'markdown', '--protected']
+end
+#Validate manfest.txt
+#rake check_manifest
+#Local checking. Creates pkg/
+#rake gem
+#create doc/
+#rake docs
+#Copy up to rubygem.org
+#rake release VERSION=1.0.1

data/lib/wikk_web_auth.rb ADDED Viewed

@@ -0,0 +1,263 @@
+module WIKK
+  require 'cgi'
+  require 'cgi/session'
+  require 'cgi/session/pstore'     # provides CGI::Session::PStore
+  require 'digest/sha2'
+  require 'syslog/logger'
+  require "wikk_aes_256"
+  require 'wikk_password'
+  #Provides common authentication mechanism for all our cgis.
+  #  @attr_reader [String] user , the remote user's user name
+  #  @attr_reader [String] session , the persistent Session record for this user
+  class Web_Auth
+    VERSION = "0.1.0" #Gem version
+    attr_reader :user, :session
+    #Create new Web_Auth instance, and proceed through authentication process by creating a login web form, if the user isn't authenticated.
+    #  @param cgi [CGI] Which carries the client data, cookies, and PUT/POST form data.
+    #  @param config [WIKK::Configuration|Hash] the location of the password file is embedded here.
+    #  @param return_url [String] If we successfully authenticate, return here.
+    #  @return [WIKK::Web_Auth]
+  	def initialize(cgi, config, return_url = nil)
+      if config.class == Hash
+        sym = config.each_with_object({}) { |(k,v),h| h[k.to_sym] = v }
+        @config = Struct.new(*(k = sym.keys)).new(*sym.values_at(*k))
+      else
+    	  @config = config
+    	end
+  	  @cgi = cgi
+      @user = ''
+      @session = nil
+  	  begin
+        @log = Syslog::Logger.syslog
+      rescue
+        @log = Syslog::Logger.new("authlib.rbx")
+      end
+      authenticate(return_url)
+    end
+    #way of checking without doing a full login sequence.
+    #  @param cgi [CGI] Which carries the client data, cookies, and PUT/POST form data.
+    #  @return [Boolean] authenticated == true.
+  	def self.authenticated?(cgi)
+      begin
+          session = CGI::Session.new(cgi, Web_Auth.session_config({'new_session' => false}) )
+          authenticated = (session != nil && session['session_expires'] > Time.now && session['auth'] == true && session['ip'] == cgi.remote_addr)
+          session.close #Writes back the session data
+          return authenticated
+      rescue ArgumentError => error # if no old session to find.
+    	  begin
+          @log = Syslog::Logger.syslog
+        rescue
+          @log = Syslog::Logger.new("authlib.rbx")
+        end
+        @log.error(error.message)
+        return false
+      end
+    end
+    #get the session reference and delete the session.
+    #  @param cgi [CGI] Which carries the client data, cookies, and PUT/POST form data.
+    def self.logout(cgi)
+      begin
+          session = CGI::Session.new(cgi, Web_Auth.session_config({'new_session' => false}))
+          session.delete if session != nil
+      rescue ArgumentError => error # if no old session
+    	  begin
+          @log = Syslog::Logger.syslog
+        rescue
+          @log = Syslog::Logger.new("authlib.rbx")
+        end
+        @log.error(error.message)
+      end
+    end
+    #Checks password file to see if the response from the user matches generating a hash from the password locally.
+    #  @param user [String] Who the remote user claims to be
+    #  @param challenge [String] Random string we sent to this user, and they used in hashing their password.
+    #  @param received_hash [String] The hex_SHA256(password + challenge) string that the user sent back.
+    #  @return [Boolean] True for authorization test suceeded.
+    def authorized?(user, challenge, received_hash)
+     begin
+       return WIKK::Password.valid_sha256_response?(user, @config, challenge, received_hash)
+     rescue IndexError => error #User didn't exist
+       @log.err("authorized?(#{user}): " + error.message)
+       return false
+     rescue Exception => error #Something else
+       @log.err("authorized?(#{user}): " + error.message)
+       return false
+     end
+    end
+    #Generate the new Session's config parameters, mixing in and/or overriding the preset values.
+    #  @param extra_arguments [Hash] Extra arguments that get added to the hash, or override values with the same key.
+    #  @return [Hash] The configuration hash.
+    def self.session_config(extra_arguments = {})
+      return {
+        'database_manager' => CGI::Session::PStore,  # use PStore
+        'session_key' => '_wikk_rb_sess_id',              # custom session key
+        #'session_id' => ?,
+        'session_expires' => (Time.now + 86400),     # 1 day timeout
+        'prefix' => 'pstore_sid_',  # PStore option
+        'tmpdir' => '/tmp',  # PStore option
+        #new_session => ?,#boolean
+        #no_hidden => ?,
+        #session_domain => ?,
+        #session_secure => ?,
+        #session_path => ?,
+        #no_cookies => ?, #boolean
+        #suffix => ?
+      }.merge(extra_arguments)
+    end
+    def session_state_init(session_options = {})
+      session_options.each { |k,v| @session[k] = v }
+    end
+    #Test to see if we are already authenticated, and if not, generate an HTML login page.
+    #  @param return_url [String] We return here if we sucessfully login
+    def authenticate(return_url = nil)
+      begin
+        @session = CGI::Session.new(@cgi, Web_Auth.session_config({'new_session' => false})) #Look for existing session.
+        return gen_html_login_page(return_url) if @session == nil
+      rescue ArgumentError => error # if no old session
+        return gen_html_login_page(return_url)
+      rescue Exception => error
+        raise Exception, "Authenticate, CGI::Session.new " + error.message
+      end
+      @session['auth'] = false if @session['session_expires'] < Time.now || #Session has expired
+                                  @session['ip'] != @cgi.remote_addr || #Not coming from same IP address
+                                  CGI::escapeHTML(@cgi['logout']) != '' #Are trying to logout
+      return if(@session['auth'] == true) #if this is true, then we have already authenticated this session.
+      if (challenge = @session['seed']) != '' #see if we are looking at a login response.
+        @user = CGI::escapeHTML(@cgi['Username'])
+        response = CGI::escapeHTML(@cgi['Response'])
+        if  @user != '' && response != '' && authorized?(@user, challenge, response)
+          @session['auth'] = true #Response valid.
+          @session['user'] = @user
+          @session['ip'] = @cgi.remote_addr
+          @session['seed'] = '' #Don't use the same one twice.
+          @session.close
+          return
+        end
+      end
+      @session.delete #Start a new session.
+      gen_html_login_page(return_url)
+      @session.close if @session != nil #Saves the session state.
+    end
+    #clean up the session, setting @authenticated to false and deleting the session state.
+    def logout
+      @session.delete if @session != nil
+    end
+    #Test to see if user authenticated,
+    #  @return [Boolean] i.e @authenticated's value.
+    def authenticated?
+      @session != nil && @session['session_expires'] > Time.now && @session['auth'] == true && session['ip'] == @cgi.remote_addr
+    end
+    #Used by calling cgi to generate a standard login page
+    #  @param return_url [String] We return here if we sucessfully login
+    def gen_html_login_page(return_url = nil)
+      session_options = Web_Auth.session_config()
+      @session = CGI::Session.new(@cgi, session_options) #Start a new session for future authentications.
+      raise "gen_html_login_page: @session == nil" if @session == nil
+      challenge = WIKK::AES_256.gen_key_to_s
+      session_state_init('auth' => false, 'seed' => challenge, 'ip' => "10.2.2.193", 'session_expires' => session_options['session_expires'])
+      @cgi.header("type"=>"text/html")
+      @cgi.out do
+        @cgi.html do
+          @cgi.head{ @cgi.title{"login"} + html_nocache + html_script() } +
+          @cgi.body {  html_login_form(user, challenge, return_url) + "\n" }
+        end
+      end
+      @session.update
+    end
+    #Used by calling cgi to inject a return URL into the html response.
+    #Called by calling cgi, when constructing their html headers.
+    #  @param url [String] URL to redirect to.
+    #  @return [String] The HTML meta header, or "", if url is empty.
+    def html_reload(url = nil)
+      if url != nil && url != ''
+        "<meta http-equiv=\"Refresh\" content=\"0; URL=#{url}\">\n"
+      else
+        ""
+      end
+    end
+    #Used by calling cgi to generate logout with this form.
+    #  @param cgi_dir [String] directory holding the login.rbx cgi.
+    #  @return [String] Html logout form.
+    def html_logout_form(cgi_dir)
+      <<-EOHTMLF2
+      <form NAME="login" ACTION="#{cgi_dir}/login.rbx" METHOD="post">
+      <input TYPE="submit" NAME="logout" VALUE="logout" >
+      </form>
+      EOHTMLF2
+    end
+    private
+    #Login form javascript helper to SHA256 Hash a password and the challenge string sent by the server.
+    #  @return [String] Javascript to embed in html response.
+    def html_script
+      <<-EOHTML
+      <script type="text/javascript" src="/js/sha256.js"></script>
+      <script language="JavaScript">
+      function sendhash() {
+          str = document.login.Password.value +
+              document.login.Challenge.value;
+          document.login.Response.value = hex_sha256(str);
+          document.login.Password.value = "";
+          document.login.Challenge.value = "";
+          document.login.submit();
+      }
+      </script>
+      EOHTML
+    end
+    #Generate html login form.
+    #  @param user [String] user's login name.
+    #  @param challenge [String] Random bytes to add to password, before sending back to server.
+    #  @param return_url [String] Pass the url we want to return to if the login succeeds.
+    #  @return [String] Login form to embed in html response to user.
+    def html_login_form(user, challenge, return_url='')
+    <<-EOHTMLF
+    <form NAME="login" ACTION="/ruby/login.rbx" METHOD="post">
+    <input TYPE="hidden" NAME="Challenge" VALUE="#{challenge}">
+    <input TYPE="hidden" NAME="Response" VALUE="">
+    <input TYPE="hidden" NAME="ReturnURL" VALUE="#{return_url}">
+    <table>
+    <tr><th>User name</th><td><input TYPE="text" NAME="Username" VALUE="#{user}" SIZE="32" MAXLENGTH="32"></td></tr>
+    <tr><th>Password</th><td><input TYPE="password" NAME="Password" VALUE="" SIZE="32" MAXLENGTH="32"></td></tr>
+    <tr><td>&nbsp;</td><td>
+      <input ONCLICK="sendhash(); return false;" TYPE="Submit" NAME="submit" VALUE="Submit">
+      <input TYPE="button" NAME="Cancel" VALUE="   Cancel   "
+      ONCLICK="document.login.Username.value='';document.login.Password.value=''">
+    </td></tr>
+    </table>
+    </form>
+    <script LANGUAGE="javascript" TYPE="text/javascript">
+          document.login.Username.focus();
+    </script>
+    EOHTMLF
+    end
+    #Generate no cache metadata header record.
+    #  @return [String] Html no-cache meta tag
+    def html_nocache
+      "<META HTTP-EQUIV=\"Pragma\" CONTENT=\"no-cache\">"
+    end
+  end
+end

metadata ADDED Viewed

@@ -0,0 +1,86 @@
+--- !ruby/object:Gem::Specification
+name: wikk_web_auth
+version: !ruby/object:Gem::Version
+  version: 0.1.0
+platform: ruby
+authors:
+- Rob Burrowes
+autorequire:
+bindir: bin
+cert_chain: []
+date: 2016-06-26 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: hoe-yard
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 0.1.2
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 0.1.2
+- !ruby/object:Gem::Dependency
+  name: hoe
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.15'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.15'
+description: Gem provides common authentication framework for Wikarekare's Ruby CGIs.
+email:
+- r.burrowes@auckland.ac.nz
+executables: []
+extensions: []
+extra_rdoc_files:
+- History.txt
+- Manifest.txt
+- README.md
+files:
+- History.txt
+- Manifest.txt
+- README.md
+- Rakefile
+- lib/wikk_web_auth.rb
+homepage: http://wikarekare.github.com/wikk_web_auth/
+licenses:
+- MIT
+metadata: {}
+post_install_message:
+rdoc_options:
+- "--markup"
+- markdown
+- "--protected"
+- "--title"
+- wikk_web_auth
+- "--quiet"
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubyforge_project:
+rubygems_version: 2.5.1
+signing_key:
+specification_version: 4
+summary: Gem provides common authentication framework for Wikarekare's Ruby CGIs.
+test_files: []